Set default Start Menu with Microsoft Intune

In Windows 10 the Start Menu layout looks horrible to me after the first sign-in to a new Windows 10 device. That`s not only the case with a Windows 10 Home edition, but even when using Windows 10 Pro or Enterprise.

Ok, that finally changes in the latest Windows 10 1903 build, only showing the Office app, Edge and the Microsoft Store app by default. But still as an admin you maybe want to add some other tiles to the Start menu to make the life of the end-user even better. Or you`re not already deploying 1903 and need to provide your users a more clean Start Menu.

With Microsoft Intune we can use a policy to set a customized Start Menu for our users, but because this is not a preference the user isn`t able to customize the Start Menu itself. I don`t prefer this option of blocking the user to configure his own Start Menu.
Another option is to define a default Start Menu which is only used to create the default Start Menu for the end-user at first logon, with the user still able to customize the Start Menu to his needs.

Such a default Start Menu can be set by using the PowerShell commands Export-StartLayout and Import-StartLayout. The layout configuration file which we get by running the Export command, can also be placed (manually) in the Default user profile. No matter which of these two options we choose to import the default Start Menu, a default Start Menu needs to by applied before the end-user first logs on to the device.

With the general availability of the Enrollment Status Page as part of Windows AutoPilot, we have the option to apply policies and software packages in the device setup stage before the end-user is logged on for the first time. Applying a PowerShell script isn`t an option during the device setup stage. But if we can package our default Start Menu configuration file in a MSI file, we can deploy that in the device setup stage. Packaging our configuration file in a MSI file is in my opinion the easiest way to get the job done.
The steps involved in this configuration are:

  • Create and export a default Start Menu
  • Create a Windows Installer Package (MSI) file
  • Deploy the MSI file with Microsoft Intune
  • Configure the Enrollment Status Page

Create and export a default Start Menu

The first thing we need to do is creating a Start Menu which we like to deploy to our Windows 10 devices. When finished customizing the Start Menu, we need to export the Start Menu with the Export-StartLayout command: Export-StartLayout -Path .\LayoutModification.xml -UseDesktopApplicationID
Have a look at the Microsoft docs for information about the Export command.
To prevent issues with pinned tiles I have used the switch -UseDesktopApplicationID

The export we get is in a XML format and contains a configuration like below. My file contains a few lines for Office ProPlus application tiles and two browsers.

Create a Windows Installer Package

The second step is to create a package which we can deploy with Intune. I used Advanced Installer Express Edition (which is free to download) to create the file.
The LayoutModification.xml file (don`t use another name for the file!) needs to be copied to the default profile. The full path is: Windows Volume\Users\Default\AppData\Local\Microsoft\Windows\Shell

  1. Start Advanced Installer
  2. Click MSIX Package (it doesn`t matter to choose MSIX package in this stage)
  3. Give the Product a Name
  4. Fill in the Organization name
  5. Click Finish

On the Product Details page uncheck Do not show in list, to prevent to installation being shown in Control Panel, Programs and Features.

On the Files and Folder tab add the LayoutModification.xml file under Windows Volume\Users\Default\AppData\Local\Microsoft\Windows\Shell
Make sure this path is correct to make this work.

On the Install parameters tab make a choice in the application folder location and package type. Make sure Reboot behavior is set to Suppress all reboots and reboot prompts.

Now we need to create a MSI file from this project. Click in the menu bar on the buildingblocks icon and choose DefaultBuild.

When finished a summary is shown with the location of the MSI file.

Deploy the MSI file with Microsoft Intune

The next step is uploading the MSI file to Intune and deploy it to the Windows 10 devices.

  1. Sign-in to the Device Management Portal
  2. Click Client Apps – Apps
  3. Click Add
  4. Select Line-of-business app as App type
  5. On the App package file tab browse to the previously created MSI file and select it
  6. Click OK

  1. Click the App information tab
  2. Give the app a Name
  3. Fill in the Description
  4. Fill in the Publisher
  5. Click OK and click Save to upload the MSI file

  1. Click the Assignments tab (when uploading the MSI file is finished)
  2. Click Add group
  3. Assign the app to your device security group of choice as required (I assigned it to our AutoPilot device group)
  4. Click Save

Configure the Enrollment Status Page

I assume the Enrollment Status Page is already enabled for your (test) users and we only need to add the Default Start Menu app as required app during the enrollment. If you require all apps to be installed during enrollment, you can skip this step.

  1. Click Device Enrollment – Windows Enrollment
  2. Click Enrollment Status Page
  3. Click the Enrollment Profile
  4. Click Settings
  5. Click Select apps
  6. Check the Default Start Menu app
  7. Click Select – Click Save

End-User experience

When everything is set, turn on a Windows 10 device which is registered as AutoPilot device in Intune.
Authenticate with a user which is targeted by the Enrollment Status Page.

During the second stage, the Device setup stage, device targeted applications are installed. During this stage the Default Start Menu application is installed and the LayoutModification.xml file is copied in the default user profile. This all happens before the end-user profile is created.

When the deployment is finished and the user is logged on for the first time to the device, the user is presented a nice and clean Start Menu. As you can see, the user is still able to (un)pin tiles.

And as you can see this is because the LayoutModification.xml file is copied in the default user profile.

Thank you for reading this article. Feel free to contact me when you have questions or comments. You can do that by leaving a comment below or send me an email.

Share This!


  1. I just did the same last week. Works like a charm. I used Michael Niehaus single MSI file Autopilot branding project in github (i presume you also know that article).
    PS. What are your findings and experience with the builtin StartMenu Lay-out policy in Intune? I think its a jok, many times it does not work, sometimes only on new profiles and pinning non installes applications is not possible.

Leave a Reply

Your email address will not be published.